Black hole (networking)

A black hole in networking is a point where packets are dropped without any ICMP error message being sent back to the source. This can occur at various layers: at the IP layer, a router may discard packets due to a null route; at the transport layer, a firewall may silently drop packets; or at the application layer, a server may accept connections but never respond.

One common mechanism is the null route (also called a blackhole route), which is a routing table entry that points to the null interface (e.g., null0 on Cisco routers). Traffic matching this route is discarded. Null routes are often used to mitigate denial-of-service (DoS) attacks by dropping traffic to a victim's IP address.

Another mechanism is Remote Triggered Black Hole (RTBH) filtering, defined in RFC 5635, which uses BGP to propagate a blackhole route across a network, allowing ISPs to quickly drop traffic to a target under attack.

Unintentional black holes can arise from misconfigured routing protocols, such as BGP route flapping or incorrect route summarization, leading to routing loops where packets are dropped. Hardware failures, such as a faulty line card, can also cause silent drops. Additionally, firewalls or ACLs may be misconfigured to drop certain traffic.

Detection of black holes is challenging because the source receives no feedback. Network administrators often use tools like ping and traceroute to identify where packets stop being answered. More sophisticated methods involve monitoring BGP routes and using synthetic probes.

In the context of email, a black hole can refer to a mail server that accepts messages but never delivers them, often due to misconfigured mail exchanger (MX) records or spam filtering.

Blackhole routing is a deliberate technique to mitigate DDoS attacks. By advertising a route to a null interface, an ISP can drop all traffic to a victim's IP address, protecting the target and the network from being overwhelmed. This is often done in coordination with the victim, and can be automated via RTBH.

Another intentional use is in sinkhole operations, where malicious traffic is redirected to a server that analyzes it. Sinkholes are used in botnet takedowns and to study malware behavior.

Blackholing can also be used for traffic engineering, such as temporarily removing a link from service by blackholing its routes.

Black holes can severely affect TCP connections, as the lack of response leads to retransmission timeouts and eventual connection failure. For UDP-based applications, such as VoIP or gaming, black holes cause packet loss without detection.

In BGP, the BGP blackhole phenomenon occurs when a router advertises a route that is not actually reachable, causing traffic to be dropped. RFC 7606 provides revised error handling for BGP UPDATE messages to mitigate such issues.

In email, a black hole can cause messages to be silently lost, which is why SMTP servers are expected to generate bounce messages when delivery fails. However, some anti-spam systems intentionally blackhole messages from known spam sources.

One lesser-known aspect is the black hole in DNS: a DNS server may be configured to return a null route for certain domains, effectively blackholing them. This is used in content filtering.

Another is the black hole in wireless networks: a node in a mobile ad hoc network may drop packets due to battery exhaustion or malicious behavior, creating a black hole that disrupts routing.

Historically, the term was used in the context of the Internet's early architecture, where certain networks were unreachable due to routing misconfigurations, leading to the term 'black hole' being coined.

There is also the concept of a black hole in network simulation, where a simulated node is intentionally set to drop packets to test protocol resilience.

Null route

A routing table entry that discards packets, often used to blackhole traffic.

RTBH

Remote Triggered Black Hole filtering, a technique using BGP to propagate blackhole routes.

Sinkhole

A server that attracts and analyzes malicious traffic.

ICMP

Internet Control Message Protocol, used for error messages; black holes do not send ICMP errors.